{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-26922","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.194Z","datePublished":"2024-04-23T13:05:04.243Z","dateUpdated":"2026-08-05T11:28:20.224Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:28:20.224Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate the parameters of bo mapping operations more clearly\n\nVerify the parameters of\namdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Triggered by the DRM_IOCTL_AMDGPU_GEM_VA ioctl on /dev/dri/renderD128 or /dev/dri/card*, which requires local access to the device node. There is no remote or adjacent-network path to amdgpu_vm_bo_clear_mappings().\nAC:L - A single ioctl with an attacker-chosen va_address/map_size pair deterministically overflows the u64 bounds check and produces a reversed range; no race, no memory-layout dependency, no timing window. The attacker fully controls both operands of the overflowing arithmetic.\nPR:L - The ioctl is DRM_AUTH|DRM_RENDER_ALLOW, so any process able to open the render node can reach it — that includes ordinary desktop users (ACL/render group), GPU-enabled containers, and sandboxed renderer processes on Android/ChromeOS. No CAP_SYS_ADMIN, no DRM_MASTER, no root required.\nUI:N - The attacker performs the entire sequence (create BO, map it, issue the crafted CLEAR) within their own process and its own amdgpu VM. No victim action or cooperation is needed.\nS:U - The corruption is confined to the kernel's own amdgpu VM structures and GPU page tables managed by the same kernel security authority. No hypervisor, IOMMU, or sandbox boundary is crossed by the flaw itself.\nC:H - The malformed split leaves overlapping GPU VA mappings with inconsistent BO offsets in vm->va, desynchronizing the driver's mapping state from the programmed PTEs, and the unvalidated range removes the max_pfn guard that keeps page-table walks in bounds. Per kernel scoring guidance, memory/page-table corruption that can be leveraged to expose memory outside the buffer object is High.\nI:H - Overlapping mappings are inserted into the VM interval tree, a mapping with start > last is queued for PTE clearing, and PRT refcounts are skewed — all of which cause GPU page tables to be programmed inconsistently with the driver's view. This memory-corruption class is scored High for integrity.\nA:H - The reversed range makes amdgpu_vm_update_range() compute (last - start + 1) * AMDGPU_GPU_PAGE_SIZE as a ~2^64 underflow, driving amdgpu_vm_ptes_update()/amdgpu_vm_pt_alloc() over an ~2^60-page range while holding the VM eviction and reservation locks. The result is unbounded page-table allocation, memory exhaustion, and a soft-lockup/hang of the GPU and system."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"],"versions":[{"version":"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44","lessThan":"d4da6b084f1c5625937d49bb6722c5b4aef11b8d","status":"affected","versionType":"git"},{"version":"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44","lessThan":"f68039375d4d6d67303674c0ab2d06b7295c0ec9","status":"affected","versionType":"git"},{"version":"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44","lessThan":"1fd7db5c16028dc07b2ceec190f2e895dddb532d","status":"affected","versionType":"git"},{"version":"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44","lessThan":"8b12fc7b032633539acdf7864888b0ebd49e90f2","status":"affected","versionType":"git"},{"version":"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44","lessThan":"212e3baccdb1939606420d88f7f52d346b49a284","status":"affected","versionType":"git"},{"version":"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44","lessThan":"ef13eeca7c79136bc38e21eb67322c1cbd5c40ee","status":"affected","versionType":"git"},{"version":"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44","lessThan":"b1f04b9b1c5317f562a455384c5f7473e46bdbaa","status":"affected","versionType":"git"},{"version":"dc54d3d1744d23ed0b345fd8bc1c493b74e8df44","lessThan":"6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"],"versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","status":"unaffected","versionType":"semver"},{"version":"4.19.313","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.275","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.216","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.157","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.88","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.29","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.8.8","lessThanOrEqual":"6.8.*","status":"unaffected","versionType":"semver"},{"version":"6.9","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"4.19.313"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.4.275"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.10.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"5.15.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.1.88"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.6.29"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.8.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.9"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d"},{"url":"https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9"},{"url":"https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d"},{"url":"https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2"},{"url":"https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284"},{"url":"https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee"},{"url":"https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa"},{"url":"https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75"}],"title":"drm/amdgpu: validate the parameters of bo mapping operations more clearly","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-04T17:14:43.597Z"}},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26922","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:46:55.644106Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:33:15.988Z"}}]},"dataVersion":"5.2"}